Weakness (CWE)
CWE-674: Uncontrolled Recursion
The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.
How to prevent it (2 mitigations)
-
Implementation
Ensure that an end condition will be reached under all logic conditions. The end condition may include checking against the depth of recursion and exiting with an error if the recursion goes too deep. The complexity of the end condition contributes to the effectiveness of this action.
-
Implementation
Increase the stack size.
Source: MITRE CWE-674
215 results · Clear filters · Feed
-
Medium 5.5
FFmpeg through 9.0.2 Uncontrolled Recursion in FLAC Parser score_header()
FFmpeg through 9.0.2 contains an uncontrolled recursion vulnerability in score_header() in libavcodec/flac_parser.c that allows attackers to exhaust the thread stack via crafted FLAC input. Attackers can supply a FLAC stream packed with many small valid-looki…
-
Medium 5.4
Heap buffer overflow in dBASE index import
LibreOffice includes a dBASE database driver, which reads dBASE tables and their .ndx index files when a folder of dBASE files is used as a data source. A heap buffer overflow existed when an index page was read. The number of entries recorded in a page was n…
-
Medium 6.5
espressif/mdns has Uncontrolled Recursion in mDNS Name Decompression
ESP-Protocols is a collection of protocol components for ESP-IDF. Prior to mDNS version 1.11.2, the `mdns` component follows DNS name-compression pointers recursively when parsing fully qualified domain names (FQDNs) in inbound mDNS packets without capping po…
-
Medium 6.5
vault-java-driver: stored deeply nested JSON kills every thread that reads it
vault-java-driver, a Java client for HashiCorp Vault, parses Vault's JSON responses with a vendored minimal-json parser that has no nesting depth limit. A deeply nested value raises a StackOverflowError, which escapes catch (Exception) handlers and kills the …
-
Medium 4.3
isomorphic-git: Circular symbolic references cause non-terminating resolution (DoS)
isomorphic-git is a pure JavaScript implementation of Git for Node.js and browsers. Prior to 1.38.6, isomorphic-git persists server-supplied circular symref= capabilities through updateRemoteRefs, and GitRefManager.resolve() follows the resulting loose symbol…
-
Medium 6.5
SurrealDB before 3.3.0 DoS via Unbounded Recursion in val::Value Serialization
SurrealDB before 3.3.0 contains an unbounded recursion vulnerability that allows authenticated users to abort the surreald process by triggering stack overflow on deeply nested values. Attackers can repeatedly run UPDATE statements wrapping a stored array in …
-
Medium 4.3
Uncontrolled Recursion in HDF5 H5B__iterate_helper() via Crafted File
HDF5 through 2.2.0 contains an uncontrolled recursion vulnerability in H5B__iterate_helper() in src/H5B.c. When iterating a version 1 B-tree, the function does not verify that a child node’s level matches the expected level. That check is performed only in H5…
-
Medium 4.3
DoS vulnerability in the file parsing module. Impact: Successful exploitation of this vulnerability may affect availabi…
-
Medium 6.5
anacrolix torrent has unbounded recursion in the bencode decoder that causes stack-overflow crash and CPU-exhaustion DoS
## Summary anacrolix/torrent's bencode decoder (`bencode/`) applies **no limit on the nesting depth** of nested dictionaries and lists. Two distinct denial-of-service mechanisms follow from that single root cause, both reachable from a single crafted `.torren…
-
Medium 5.9
Pistache: DoS via stack exhaustion in REST router path normalization (regex_replace on long slash runs)
Pistache is a high-performance REST toolkit written in C++. From 0.0.5 through 0.4.26, `SegmentTreeNode::sanitizeResource()` in `src/server/router.cc` uses `std::regex_replace()` with the `//+` expression to collapse consecutive slashes. With libstdc++, a pat…
-
Medium 6.3
Crass: A large number of adjacent CSS comments can trigger a SystemStackError
Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, when the `:preserve_comments` option is not enabled, which is the default, Crass discards CSS comments by recursively consuming the next token. An att…
-
Medium 6.3
Crass: Deeply nested CSS blocks and functions can trigger a SystemStackError or excessive memory usage
Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, Crass recursively parses `CSS simple blocks and functions` without a depth guard. An attacker-controlled CSS value containing deeply nested blocks or …
-
Medium 4.3
Org.infinispan/infinispan-query: infinispan: deeply nested ickle queries can trigger a stackoverflowerror
A flaw was found in the Ickle query parser in Infinispan. A query containing deeply nested predicates can cause recursive parsing to exhaust the Java thread stack and throw an uncaught StackOverflowError. An authenticated user with BULK_READ permission who ca…
-
Medium 5.5
SQLite before 3.54.0 Stack Exhaustion via countOfViewOptimization() in VALUES Clause
SQLite before 3.54.0 contains a stack exhaustion vulnerability in countOfViewOptimization() that allows attackers to crash the host process via count(*) over a large multi-row VALUES clause. Attackers supplying SQL or a database file with a crafted view can t…
-
Medium 5.5
SQLite before 3.54.0 Stack Exhaustion via COLLATE Operator Chain
SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITE_LIMIT_EXPR_DEPTH limit by chaining COLLATE postfix operators. Attackers can supply roughly 175,000 chained COLLATE operators in SQL or an untrusted datab…
-
Medium 5.5
SQLite before 3.54.0 Stack Exhaustion via CTE Chain in selectExpander()
SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITE_LIMIT_EXPR_DEPTH nesting limit because common table expressions are not counted against it. Attackers can supply a WITH clause chaining tens of thousands…
-
Medium 5.3
Wasmtime 42.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Stack Overflow via Type Registry
Wasmtime 42.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a stack overflow vulnerability that allows guests to crash the host through recursive type drops. Guests can define a long chain of recursive types so that removing the top-level type triggers un…
-
Medium 6.5
Server-side expression parser denial of service
A user with the Viewer role in Grafana can crash the server by submitting a crafted server-side math expression (uncontrolled recursion). A user with permission to provision alert rules can make the outage persist across restarts.
-
Medium 6.9
Go JOSE: Panics in JSON parsing
Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.5, parsing attacker-controll…
-
Medium 5.9
Infinite recursion (CPU denial-of-service) in JOSE.JWK.shared_secret/2 on mismatched key types
jose_jwk:shared_secret/2 (exposed in Elixir as JOSE.JWK.shared_secret/2) derives an ECDH shared secret from two JWKs. Its first function clause only matches when both JWKs carry the same key type (kty) module, and its fallback clause re-invokes itself as shar…
-
Medium 6.0
Authenticated Denial-of-Service in Zigbee Publish Billing Period
In EmberZNet 9.1.1 and earlier, a malformed Publish Billing Period command can result in a recursive function call that will never reach its end condition. These messages must come from a device that has already joined the network. Only devices supporting the…
-
Medium 6.3
Uncontrolled Recursion on Nested JSON Allows Denial of Service in android-json
The org.json parser in com.vaadin.external.google:android-json recurses once per nesting level with no depth limit: JSONTokener.nextValue() calls readArray() and readObject(), which call nextValue() again. A deeply nested JSON document, around 20 KB of nested…
-
Medium 6.2
Libmodulemd: libmodulemd: unbounded recursion when parsing nested xmd yaml
A flaw was found in libmodulemd. When parsing module metadata, the xmd field is converted into nested GVariant values through recursive YAML mapping and sequence helpers without a recursion-depth or node-count limit. An attacker who can supply crafted modulem…
-
Medium 5.3
ApostropheCMS sanitize-html: unbounded recursion when re-sanitizing the fallback of a discarded iframe (stack overflow, nestingLimit not enforced)
ApostropheCMS is an open-source Node.js content management system. In sanitize-html 2.18.0, when an <iframe> is not allowed and disallowedTagsMode is 'discard' (the defaults), its raw-text content is re-sanitized by a recursive call to sanitizeHtml(text, opti…
-
Medium 6.5
pupnp: Incomplete fix for CVE-2021-28302: recursive DOM functions cause stack overflow
pupnp is an SDK for development of UPnP device and control point applications. Prior to 2.0.0, multiple ixml DOM traversal functions process deeply nested XML with unbounded recursion. The iterative XML parser accepts the document, but ixmlPrintDomTreeRecursi…
-
Medium 5.5
OW2 ASM 3.0 before 9.11 Uncontrolled Recursion in SignatureReader
OW2 ASM 3.0 before 9.11 contains an uncontrolled recursion vulnerability in SignatureReader.parseType() that allows attackers to exhaust the stack via deeply nested generic type signatures. Attackers can supply a crafted class file with a long Signature attri…
-
Medium 5.5
OW2 ASM 3.0 before 9.11 Uncontrolled Recursion via ClassWriter.replaceAsmInstructions()
OW2 ASM 3.0 before 9.11 contains an uncontrolled recursion vulnerability in ClassWriter.replaceAsmInstructions() that allows attackers to cause denial of service through crafted class files. Attackers can supply a class with a large method containing many lon…
-
Medium 5.3
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Stack Overflow in MSL Decoder
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a stack overflow in the MSL decoder caused by an incorrect depth check that fails to limit recursion. Attackers can supply a set of crafted MSL images that exhaust the stack when one of them is rea…
-
Medium 5.9
OWASP Coraza WAF: Unbounded recursion in JSON response body processor causes CPU exhaustion
OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, ProcessResponse in internal/bodyprocessors/json.go passes the ignoreJSONRecursionLimit value of -1 to readJSON, while the recursive guard only stops …
-
Medium 5.9
Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote attacker to cause a denial of service due to uncontrolled recursion.
-
Medium 5.3
msgpack5: Deeply nested input can exhaust the decoder stack
msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the array and map decoding paths have no nesting-depth limit, allowing an attacker who can provide MessagePack input to submit deeply nested containers that exhaust the JavaS…
-
Medium 4.7
FFmpeg through 9.0.2 Stack Exhaustion via Recursive Free of pssh Boxes
FFmpeg through 9.0.2 contains a stack exhaustion vulnerability in av_encryption_init_info_free() in libavutil/encryption_info.c, which recursively frees AVEncryptionInitInfo linked lists built by the MOV demuxer's mov_read_pssh(). Attackers can supply a craft…
-
Medium 5.5
Uncontrolled recursion in DCMTK JSON reader allows denial of service
Uncontrolled mutual recursion between DcmJSONReader::parseDataSet(), DcmJSONReader::parseElement() and DcmJSONReader::parseSequence() in dcmdata/libsrc/dcjsonrd.cc of OFFIS DCMTK 3.7.0 allows an attacker to cause a denial of service (stack exhaustion and proc…
-
Medium 5.5
Uncontrolled recursion in DCMTK xml2dcm allows denial of service
Uncontrolled mutual recursion between DcmXMLParseHelper::parseDataSet() and DcmXMLParseHelper::parseSequence() in the XML-to-DICOM converter (dcmdata/libdcxml/xml2dcm.cc) of OFFIS DCMTK 3.7.0 allows an attacker to cause a denial of service (stack exhaustion a…
-
Medium 5.5
Uncontrolled recursion in DCMTK DICOMDIR parsing allows denial of service
Uncontrolled recursion in DcmDicomDir::moveRecordToTree() in dcmdata/libsrc/dcdicdir.cc of OFFIS DCMTK 3.7.0 allows an attacker to cause a denial of service (stack exhaustion and process crash) via a crafted DICOMDIR file with a deeply chained sequence of dir…
-
Medium 5.5
Uncontrolled recursion in the DCMTK bundled XML parser allows denial of service
Uncontrolled recursion in XMLNode::ParseXMLElement() and XMLNode::emptyTheNode() in the bundled XML parser (ofstd/libsrc/ofxml.cc) of OFFIS DCMTK 3.7.0 allows an attacker to cause a denial of service (stack exhaustion and process crash) via a crafted XML docu…
-
Medium 5.3
ImageMagick: Denial of service with crafted XMP profile
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-30 and 6.9.13-55, a crafted XMP profile can reach a recursion limit that is handled as a fatal condition instead of an ordinary exception, terminatin…
-
Medium 5.3
ImageMagick: Stack Overflown CALS decoder due to missing depth check.
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-30 and 6.9.13-55, a missing recursion-depth check in the CALS decoder allows a crafted CALS image to exhaust the call stack and terminate the process…
-
Medium 6.5
Uncontrolled Recursion in Elasticsearch Leading to Denial of Service
Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to Denial of Service via a specially crafted request that causes the server to construct and process a deeply nested data structure with no bound on recursion depth. Elasticsearch contains an uncontro…
-
Medium 6.5
Uncontrolled Recursion in Elasticsearch Leading to Denial of Service
Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to Denial of Service via a specially crafted, deeply nested request submitted to the aggregation feature of the search API. Elasticsearch contains an uncontrolled recursion weakness in its search aggr…